Content item instance access control
Techniques for content item instance access control are described herein. A computing service provider may host execution of a plurality of instances of an interactive content item, such as a video game. Each content item instance may be accessible to a respective set of one or more authorized clients that are associated with the respective content item instance and that are authorized to access the respective content item instance. Additionally, in one embodiment, each content item instance may be inaccessible to one or more unauthorized clients, such as clients that are not associated with the respective content item instance and that are not included in the set of authorized clients. By limiting access to a content item instance to authorized clients, the content item instance may be protected from malicious users, such as hackers, DoS and DDos attackers, and other malicious users.
1. A system comprising:
one or more processors
one or more memories storing a set of instructions, which upon execution by the one or more processors, causes the one or more processors to perform operations comprising:
receiving, by a service, a first request for a first client to join an interactive video game, the interactive video game including a plurality of video game instances, wherein a plurality of access control components control access to the plurality of video game instances, each of the plurality of video game instances being associated with one or more respective access control components of the plurality of access control components;
determining a first Internet Protocol (IP) address associated with the first request;
associating the first client with a first instance of the plurality of video game instances, wherein the first instance is accessible to a set of one or more authorized clients and inaccessible to one or more unauthorized clients;
providing, by the service that receives the first request, the first IP address to one or more first access control components of the plurality of access control components, the one or more first access control components associated with the first instance;
maintaining, by the one or more first access control components, information regarding the set of one or more authorized clients to which the first instance is accessible;
associating the first IP address with the set of one or more authorized clients;
providing to the first client, address information associated with the first instance;
receiving a second request for the first client to connect to the first instance, the second request being associated with the first IP address;
determining, by the one or more first access control components, whether the first IP address associated with the second request is associated with the set of one or more authorized clients; and if so,
providing the first client access to the first instance.
2. The system of claim 1 , wherein the operations further comprise:
receiving a third request for a second client to connect to the first instance, the third request sent from a second IP address that is not associated with the set of one or more authorized clients;
determining that the second IP address is not associated with the set of one or more authorized clients; and
denying the second client access to the first instance.
3. The system of claim 1 , wherein a port number of the first instance is assigned at random.
4. The system of claim 1 , wherein the operations further comprise:
detecting an error condition associated with granting access to the first instance; and
determining to allow additional IP addresses to access the first instance.
5. A method comprising:
receiving, by a service, a first request for a first client to join an interactive video game, the interactive video game including a plurality of video game instances, wherein a plurality of access control components control access to the plurality of video game instances, each of the plurality of video game instances being associated with one or more respective access control components of the plurality of access control components;
determining a first Internet Protocol (IP) address associated with the first request;
associating the first client with a first instance of the plurality of video game instances, wherein the first instance is accessible to a set of one or more authorized clients and inaccessible to one or more unauthorized clients;
providing, by the service that receives the first request, the first IP address to one or more first access control components of the plurality of access control components, the one or more first access control components associated with the first instance;
maintaining, by the one or more first access control components, information regarding the set of one or more authorized clients to which the first instance is accessible;
associating the first IP address with the set of one or more authorized clients;
providing to the first client, address information associated with the first instance;
receiving a second request for the first client to connect to the first instance;
determining, by the one or more first access control components, whether the first IP address associated with the second request is associated with the set of one or more authorized clients associated with the first instance; and if so,
providing the first client access to the first instance.
6. The method of claim 5 , further comprising:
receiving an additional request for a second client to connect to the first instance, the additional request sent from a second IP address that is not associated with the set of one or more authorized clients;
determining that the second IP address is not associated with the set of one or more authorized clients; and
denying the second client access to the first instance.
7. The method of claim 5 , wherein the second request for the first client to connect to the first instance is addressed using the address information.
8. The method of claim 5 , wherein the address information comprises an IP address of the first instance and a port number of the first instance.
9. The method of claim 5 , wherein a port number of the first instance is assigned at random.
10. The method of claim 5 , further comprising:
detecting an error condition associated with granting access to the first instance; and
determining to allow additional IP addresses to access the first instance.
11. The method of claim 5 , further comprising tracking a quantity of video game instance creation requests issued by the first client.
12. The method of claim 11 , further comprising denying a video game instance creation request from the first client that results in meeting or exceeding a threshold quantity of allowed requests.
13. A non-transitory computer-readable storage medium having stored thereon a set of instructions, which upon being performed by one or more computing devices, causes the one or more computing devices to perform operations comprising:
receiving, by a service, a first request for a first client to join an interactive video game, the interactive video game including a plurality of video game instances, wherein a plurality of access control components control access to the plurality of video game instances, each of the plurality of video game instances being associated with one or more respective access control components of the plurality of access control components;
determining a first Internet Protocol (IP) address associated with the first request;
associating the first client with a first instance of the plurality of video game instances, wherein the first instance is accessible to a set of one or more authorized clients and inaccessible to one or more unauthorized clients;
providing, by the service that receives the first request, the first IP address to one or more first access control components of the plurality of access control components, the one or more first access control components associated with the first instance;
maintaining, by the one or more first access control components, information regarding the set of one or more authorized clients to which the first instance is accessible;
associating the first IP address with the set of one or more authorized clients;
providing to the first client, address information associated with the first instance;
receiving a second request for the first client to connect to the first instance;
determining, by the one or more first access control components, whether the first IP address associated with the second request is associated with the set of one or more authorized clients associated with the first instance; and if so,
providing the first client access to the first instance.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the operations further comprise:
receiving an additional request for a second client to connect to the first instance, the additional request sent from a second IP address that is not associated with the set of one or more authorized clients;
determining that the second IP address is not associated with the set of one or more authorized clients; and
denying the second client access to the first instance.
15. The non-transitory computer-readable storage medium of claim 13 , wherein the second request for the first client to connect to the first instance is addressed using the address information.
16. The non-transitory computer-readable storage medium of claim 13 , wherein the address information comprises an IP address of the first instance and a port number of the first instance.
17. The non-transitory computer-readable storage medium of claim 13 , wherein a port number of the first instance is assigned at random.